For: anyone who registered an email address and became a member on the official online shop of Internet Hana-cupid (i879.com) or Business Hana-cupid (i879.com/biz/), including former members whose leak was confirmed. This article is based on Hana-cupid Co., Ltd.'s official notice and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 30, 2026Not yet known
- Cause
- When individual contact will be complete
- Whether any secondary harm occurs
- Investigation results and details of prevention measures
The company says that if a significant new fact is established it will promptly announce it on its official website and elsewhere. It gives no schedule. We checked the notice page on October 30 and found no announcement newer than the October 28 notice.
What members should do today
Work out whether you could be affected
The company covers members who registered an email address on its official online shop (i879.com, i879.com/biz/). It says orders through external shopping malls, phone orders where no email address was registered, and purchases at Hana-cupid member florists are not covered.
It says it began emailing members whose leak was confirmed individually, to their registered email address, on October 28. Because so many people are covered, it expects contact to take some time. It says it is also guiding former members individually if their leak was confirmed (accounts of former members cannot be logged in to).
If the email has not reached you but you remember registering, assume you could be affected and go on to the next steps.
Change your password
The company judges the chance of an account being misused right away to be low because the passwords are stored in a form that cannot be restored or decoded, but it recommends changing your password to be safe.
The procedure the company points to is the ID confirmation and password reset page (Internet Hana-cupid / Business Hana-cupid, in Japanese). The notice does not say whether there is a change-password screen after logging in. The user ID defaults to your registered email address (6 or more letters and digits if that address was already registered or you changed it).
Change any other service where you reused the same ID and password
The company recommends that anyone who reused the same login ID and password on other services change the password on those services too.
Here, the pair of user ID (often an email address) and password is involved. If you use that pair elsewhere, change it there first (how to check if your password was leaked / choosing a password manager). Turn on two-step verification where available.
Do not open links in messages claiming to be from Hana-cupid or a financial institution
The company warns that suspicious emails (phishing and the like) posing as the company or financial institutions may be sent using the leaked email addresses. It asks you not to open URLs in messages you do not recognise, not to open attachments and not to enter personal information. It says it never asks for passwords, credit card numbers, PINs, verification codes or the like by email, text or phone.
The email addresses that leaked belong to Hana-cupid members. So if one of the following arrives, check it without opening the link (this is this site's reading; the company has not confirmed any such cases):
- Messages posing as an "order confirmation", "delivery status" or "a gift message has arrived"
- Messages pressing you to "update your member details", "reset your password" or warning of "account suspension"
- Messages copying the company's individual notice email and asking for a password or card number
As this site's advice, open the official site yourself (from a bookmark or a search), or call the personal information consultation line (0120-805-666, 9:00 to 17:30 Japan time).
The company says no credit card action is needed
The company says it does not hold credit card information in the affected database, so there is no need to stop or reissue a card because of this incident. Checking your card statement regularly is still sensible, whatever this incident.
1. Email / text / call claiming to be Hana-cupid or a bank
Looks like an order, delivery or gift notice → do not decide here
↓
2. Do not open its links: open the official site yourself, or call the consultation line
Personal information consultation line 0120-805-666
↓
3a. Asks for a password, PIN or card number
The company says it never asks for these → do not respond
3b. The official site gives the same guidance
Follow the official site's instructions
What happened (according to Hana-cupid Co., Ltd.)
The following is based on the notice "Apology and notice regarding the member information leak caused by unauthorized access to sites operated by the company (Internet Hana-cupid and others)", published on October 28, 2026, and the Q&A on the same page.
Oct 14 (Wed) to Oct 15 (Thu), 2026
A third party accessed the management system without authorization.Oct 19 (Mon)
During its investigation, the company confirmed that member information had leaked through the unauthorized access.Oct 28 (Wed)
Announced. Individual emails to affected members began in stages. The company says it has reported to the Personal Information Protection Commission and the police (cybercrime consultation line); no date is given for the report.
- Services involved
- Internet Hana-cupid / Business Hana-cupid
- Leaked items
- User ID (login ID); password (an encrypted form that cannot be used as it is; called hashed in the FAQ); PC email address; mobile email address
- Items the company says did not leak
- Name, gender, date of birth, address, phone number, credit card number, company name, department name, delivery destination information and the like
- Who is covered
- Only customers who registered an email address on the official online shop. Orders through external shopping malls, phone orders without a registered email address, and purchases at member florists are not covered
- Company response
- Blocked every attack route used and strengthened access control and monitoring; reported to the Personal Information Protection Commission and the police; working with an external specialist organisation to investigate the cause in detail
- Compensation
- No monetary compensation or refund planned (the company adds that the leaked information includes no payment-related information and that the passwords are managed in encrypted form)
- Contact
- Internet Hana-cupid personal information consultation line 0120-805-666 (9:00 to 17:30 Japan time)
What "encrypted password" means here
The company says the leaked passwords were stored in a form that "cannot be restored or decoded" (irreversible encryption). The FAQ calls this "hashing". Hashing turns a password into a different string by a one-way calculation and stores that, so the original password cannot be taken back out of the stored string. It differs from ordinary encryption, which a key can undo (what password hashing is / how to store passwords safely).
The notice does not say which method was used. In general, short or common passwords can still be guessed by comparing against the stored string. The company recommends changing your password to be safe.
What is known and what is not
Status as of October 30, 2026. We will update this table as the company publishes more.
| Item | What the notice says | Status |
|---|---|---|
| Unauthorized access occurred | To the management system on Oct 14 to 15; leak of member information confirmed Oct 19 | Confirmed (company) |
| User ID (login ID) | Leak confirmed | Leak confirmed (company) |
| Password | Encrypted (hashed); described as stored in a form that cannot be restored or decoded | Leak confirmed (company) |
| PC and mobile email addresses | Leak confirmed | Leak confirmed (company) |
| Count | 4,238,242 (customers who may be affected) | Confirmed (company); a count of possible cases |
| Name, gender, date of birth, address, phone number, delivery destination, company and department name | Did not leak | Not included (company) |
| Credit card information | Not held; no payment information leaked | Not included (company) |
| Former members | Those whose leak was confirmed are guided individually; former members' accounts cannot be logged in to | Guided individually if leak confirmed (company) |
| Cause and route of the intrusion | Not stated; under investigation with an external specialist organisation | Under investigation |
| Individual contact | By email in stages from Oct 28; takes some time; the notice stands in for those who cannot be reached | In progress (company) |
| Secondary harm | Not confirmed as of Oct 28; warns of phishing and the like | Not confirmed (company) |
| Compensation | No monetary compensation or refund planned | Confirmed (company) |
| Other databases or other services | Not stated | Not stated |
Note: the count is of customers who may be affected
4,238,242 is the number the company describes as "customers who may be affected". The company calls it a count and also says "customers who may be affected" in brackets. It does not say whether the number of people is smaller where one person has several accounts. This site uses "up to" in the title and elsewhere.
What user IDs and email addresses can generally be used for
The following is what can generally happen with this combination of items. The company has not announced that any of it has happened in this incident.
- Email addresses (PC and mobile): can be used as targets for fake emails and texts posing as the company or financial institutions. They show that the owner is a Hana-cupid member, so messages can pose as order, delivery or gift notices
- User ID + encrypted password: the company judges the chance of an account being misused right away to be low. In this site's view, if the password is reused, attempts to log in to other services become possible
- Name, address and phone number not being included: with only an email address, it is harder to build a fake that includes your name. It can still be combined with separate information gathered elsewhere, unrelated to this incident
Most of this can be prevented by not using the links or numbers in a message and checking on an official site you open yourself (what phishing is).
What operators should review
The cause has not been disclosed, so this section covers only what can be said from the published information.
- Keeping passwords in a form that cannot be restored: the company explains that the passwords having been stored irreversibly is a point that limits the impact. For how to choose a storage method, see how to store passwords safely
- What you keep after cancellation: the company says it is guiding former members individually too. Decide what to keep after cancellation and for how long, and delete information once the period has passed
- Guarding the way into the management system: the notice says only that a management system was accessed without authorization. How to guard the entrance to the management system can be made specific once the cause is published
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause or the route of the intrusion, which have not been announced.
- Hana-cupid Co., Ltd., "Apology and notice regarding the member information leak caused by unauthorized access to sites operated by the company (Internet Hana-cupid and others)" (Japanese, October 28, 2026, including the Q&A on the same page; checked October 30) — hana-cupid.co.jp
- Hana-cupid, "User ID confirmation and password reissue" (Japanese, the procedure page the company points to) — i879.com
Update history
2026-10-30: First version, based on Hana-cupid Co., Ltd.'s notice of October 28 (including its Q&A). No announcement newer than the October 28 notice found. We will update when the cause, the end of individual contact or any secondary harm is announced.
Read next
- Similar cases from the same period: MrMax (members' names, emails and phone numbers) / NIFTY unauthorized access
- Follow-on scams: What is phishing? / Smartphone security basics
- Protect your accounts: How to check if your password was leaked / Choosing a password manager / Choosing multi-factor authentication
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)